Date: Sun, 22 Mar 2009 23:05:54 +0000 (GMT) From: Robert Watson <rwatson@FreeBSD.org> To: Mike Silbersack <silby@FreeBSD.org> Cc: svn-src-stable@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, svn-src-stable-7@freebsd.org Subject: Re: svn commit: r190299 - stable/7/sys/kern Message-ID: <alpine.BSF.2.00.0903222305120.85640@fledge.watson.org> In-Reply-To: <200903222300.n2MN00IO086771@svn.freebsd.org> References: <200903222300.n2MN00IO086771@svn.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 22 Mar 2009, Mike Silbersack wrote:
> Fix unp_gc so that it recognizes file descriptors
> that are currently in the process of being passed
> between processes as alive and does not
> try to garbage collect them.
>
> The full description of the problem and a test
> program to reproduce it can be found in PR 112554.
>
> This fix was inspired by similar fixes in NetBSD and BSD/OS.
> However, it does not apply to FreeBSD 8 and above -
> when this code was rewritten and optimized, the bug
> was fixed in a different way. The test program in the
> PR passes on 8-current with flying colors.
We have a UNIX domain socket-passing regression test that creates various
contortion-esque situations and then looks to see if sockets were leaked. If
it doesn't yet capture this failure mode, could you add it to that test?
Robert N M Watson
Computer Laboratory
University of Cambridge
>
> PR: 112554
> Submitted by: Spencer Minear
> Reviewed by: Mike Silbersack
> Obtained from: Secure Computing Corp
> MFC after: 4 weeks
>
> Modified:
> stable/7/sys/kern/uipc_usrreq.c
>
> Modified: stable/7/sys/kern/uipc_usrreq.c
> ==============================================================================
> --- stable/7/sys/kern/uipc_usrreq.c Sun Mar 22 22:57:53 2009 (r190298)
> +++ stable/7/sys/kern/uipc_usrreq.c Sun Mar 22 23:00:00 2009 (r190299)
> @@ -1878,6 +1878,7 @@ unp_gc(__unused void *arg, int pending)
> {
> struct file *fp, *nextfp;
> struct socket *so;
> + struct socket *soa;
> struct file **extra_ref, **fpp;
> int nunref, i;
> int nfiles_snap;
> @@ -1984,6 +1985,20 @@ unp_gc(__unused void *arg, int pending)
> SOCKBUF_UNLOCK(&so->so_rcv);
>
> /*
> + * If socket is in listening state, then sockets
> + * in its accept queue are accessible, and so
> + * are any descriptors in those sockets' receive
> + * queues.
> + */
> + ACCEPT_LOCK();
> + TAILQ_FOREACH(soa, &so->so_comp, so_list) {
> + SOCKBUF_LOCK(&soa->so_rcv);
> + unp_scan(soa->so_rcv.sb_mb, unp_mark);
> + SOCKBUF_UNLOCK(&soa->so_rcv);
> + }
> + ACCEPT_UNLOCK();
> +
> + /*
> * Wake up any threads waiting in fdrop().
> */
> FILE_LOCK(fp);
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.00.0903222305120.85640>